Application Security Still Slows Developer Work

Cooperation among DevOps teams might be growing, but security testing still seen as a road block to continuous delivery.

The cooperative nature of DevOps software delivery has done a lot to reduce friction between operations staff and developers, but looping security into the greater process still remains a challenge. According to a survey out today from Veracode, over half of developers report that security causes delays in the development process.

Conducted among more than 350 developers worldwide, the survey took a look at developer perceptions of application security and the impact that security testing has on their professional lives. As things stand, 52% of developers and 54.3% of DevOps managers report that security testing slows down development and threatens deadlines. This was the biggest challenge they reported about their work. Closely following that challenge is the difficulty of legacy application security processes adding complexity and slowing time-to-market, which was reported as a top challenge by 46% of developers and 44% of DevOps managers.

This is a huge business problem considering the intense heat turned up by the business on developers and DevOps to shorten development timelines. In a report earlier this year, Forrester found that 88% of developers feel increased pressure to produce more frequent releases. A little more than half of developers surveyed for that report now release at least monthly and 77% say that the business is also demanding software with more complex requirements and capabilities.

While there's clearly a lot of work to offer a more seamless mode of injecting security into the development process, the Veracode survey shows that a statistically significant ratio of organizations are moving in the right direction.

"Although it’s a best practice to address security early in the software development lifecycle, the shift towards continuous delivery and DevOps is providing more opportunities to integrate security throughout the entire lifecycle," the survey report explained. The study shows that the majority of organizations are seeking to incorporate security earlier in the software development lifecycle, with only about 16% relying inserting it after the programming stage. One of the best signs is that almost one in three organizations say they're involving security during requirements or design phases of development.

According to analysts with Forrester, that's huge not just for the security of the software but also the value an organization gets out of it.

"Developers who regularly collaborate with their security colleagues on software development tasks get significant value from their efforts, which produce major and tangible business and technical benefit," Forrester experts write.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

I hear this complaint all the time, have even been the one complaining in the past. Perhaps the answer is in refining the existing processes of development and operations to make security an integral function. If you've been hired as a programmer for a killer app that uses some new killer lib, you'd never say "Gee, learning how to program against this new library is really slowing my time to market down!" That's your job, to learn, to experiment, and to do it in a timely fashion. So should secure programming be, and so should security in general. It is as integral to software projects and release infrastructures as learning how to program is. DevOps especially should be an innovator of finding common ground for security to be embraced on by both coders and security engineers. You know what a really killer app is? An unhackable app; uncrackable and well coded. A secure app that protects the user's data while still being useful. That kind of app doesn't just appear, it needs to be intentionally created, and lovingly created. These rifts and complaints about security bringing down the dev process isn't going to produce that killer app.

Wow! Is everyone ever missing the point here! When cybersecurity testing is included in functional testing or QA then these types of surveys go away. Cybersecurity is a core component of any code or it should be. Failing to see this and recognize its importance just shows how ignorant the development community still is. None of these survey respondents seemed to complain about functionality testing or QA cycles in their development plans did they?

Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...

A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...

An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page &quot;/ui/cbpc/login&quot; is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie &quot;sid&quot; generated by the page. The attacker will have acc...